I too work in this regulated business, and don't think your argument holds unless you don't inventory your dependencies and regularly scan code (source code and

I too work in this regulated business, and don't think your argument holds unless you don't inventory your dependencies and regularly scan code (source code and dependencies) for vulnerabilities